Method and System for Preemptive Scanning of Computer Files

1. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, reduces computer file system access time associated with on-access scanning in a computing facility by performing the steps of: receiving file access information describing a pattern of access of each of a plurality of computer files including a first computer file and a second computer file that have been accessed in a computer file system; processing the file access information to generate a file access performance cost statistic for each of the plurality of computer files; maintaining the file access performance cost statistic for each of the plurality of files accessed by the computing facility; generating a file access performance cost mapping of the computing facility's file system relating to the plurality of computer files; generating a locality statistic from the performance cost map of a probability that the second computer file will be accessed near the time that the first computer file is accessed; and pre-scanning the second computer file when the probability is high that the second computer file will be accessed after the first computer file has been accessed.

2. The computer program product of claim 1 , wherein the file access information includes a file name of each of the plurality of computer files.

3. The computer program product of claim 1 , wherein the file access information includes a time indicating when each of the plurality of computer files was accessed.

4. The computer program product of claim 1 , wherein the file access information includes a time duration of on-access scan time for each of the plurality of computer files.

5. The computer program product of claim 1 , wherein the file access performance cost statistic is a measure of an aggregate effect on the computing facility's system performance associated with access of a computer file from the plurality of files.

6. The computer program product of claim 5 , wherein the aggregate effect includes an effect of the on-access scanning of the computer file.

7. The computer program product of claim 1 , wherein the file access performance cost mapping is an indication of which of the plurality of files in the file system produce the greatest time aggregate file access effect based on the computing facility's system performance.

8. The computer program product of claim 1 , wherein the file access performance cost mapping is generated from the access performance cost statistic for each of the plurality of files accessed by the computing facility.

9. The computer program product of claim 1 , wherein the step of pre-scanning accesses at least one of the plurality of files for scanning prior to the file being called for a use.

10. The computer program product of claim 1 , wherein the step of pre-scanning is performed during periods of low computing facility processing activity.

11. The computer program product of claim 1 , wherein the step of pre-scanning reduces the need to scan the computer file when the computer file is accessed.

12. The computer program product of claim 1 , wherein the step of pre-scanning is a malware pre-scanning step.

13. The computer program product of claim 1 , wherein the step of pre-scanning is a DLP pre-scanning step.

14. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, reduces computer file system access time associated with on-access scanning in a computing facility by performing the steps of: receiving first file access information describing a pattern of access of a first computer file in a computer file system; receiving second file access information describing a pattern of access of a second computer file in a computer file system; processing the first and second file access information to generate a file access locality statistic, wherein the file access locality statistic is related to the probability that the second computer file is accessed subsequent to and near in time to the access of the first computer file; and pre-scanning the second computer file after a subsequent access of the first computer file from the computer file system based on the file access locality statistic.

15. The computer program product of claim 14 , wherein the file access information includes a file name of the computer file.

16. The computer program product of claim 14 , wherein the file access information includes a time indicating when the computer file was accessed.

17. The computer program product of claim 14 , wherein pre-scanning accesses the computer file for scanning prior to the computer file being called for a use.

18. The computer program product of claim 14 , wherein pre-scanning is performed during periods of low computing facility processing activity.

19. The computer program product of claim 14 , wherein pre-scanning reduces the need to scan the computer file when the computer file is accessed.

20. A computer program product embodied in a non-transitory computer readable medium that, when executing on one or more computers, reduces computer file system access time in a computing facility by performing the steps of: receiving file access information describing a pattern of access of each of a plurality of computer files that have been accessed in a computer file system; processing the file access information to generate a file access performance cost statistic associated with each computer file; maintaining the file access performance cost statistic for each computer file; generating a file access performance cost mapping of the computing facility's file system relating to the plurality of computer files; generating a locality statistic from the performance cost map of a probability that the second computer file will be accessed near the time that the first computer file is accessed; and pre-scanning the second computer file when the probability is high that the second computer file will be accessed when that first computer file has been accessed.